Handicapped Access to Mark-Sense Ballots

U.S. Patent 7,134,597granted Nov. 14, 2006, filed Sept. 8, 2002

Overview

Most recent work on handicapped access to voting systems has assumed
that direct recording electronic voting machines were naturally required
if we want to achieve a reasonable standard of accessibility for
handicapped voters. This work proposes an an optical mark-sense voting
system that may meet reasonable standards for handicapped accessibility.
This system should allow most blind and otherwise disabled voters to
cast votes and to inspect the votes they have cast using pencil marks
on a commonplace paper ballot designed for machine tabulation using
a mark-sense tabulation system.

The complete system proposed here consists of a number of tools, some of
which meet the needs of only one class of handicap, while others meet the
needs of broad ranges of handicaps. The estimated cost of this complete
suite of tools comes to under $500 per polling place. Most of these tools
are shown in Figure 1 and all are listed below:

The classic tool for marking an optical mark-sense form is the number-two
soft lead pencil, and this handicapped accessible voting system uses this,
without modification. People with certain motor disabilities may find it
easier to use a large-diameter pencil, comparable to those routinely used in
lower level elementary school penmanship classes. It may be feasible to use
a dry-erase or washable marker, but because of the need to avoid defacing the
ballot holder, other types of marking pens should not be used with this system.

A magnifying glass.

One of the most common problems we must acommodate is mild to moderate
vision impairment. Hand magnifiers are frequently used by people with such
problems, and one should be provided in each polling place that is intended
to be handicapped accessible. This is already done in several
jurisdictions, and it should be done in all.

A ruler.

People with certain visual disorders have a very difficult time dealing
with tabular material. For example, those with a limited field of vision
frequently have difficulty tracking across a ballot from the candidate name
to the target to be marked when casting a vote. Simple tools such
as a ruler or straightedge greatly reduce this difficulty, so one should be
provided in each polling place.

A ballot holder.

This multipurpose device is the subject of most of the following
proposal and is the most expensive part of the proposed system; it is
intended to aid both blind voters and those with moderate to severe
motor disabilities as they mark their ballots.
The ballot holder may be augmented with a braille overlay to acommodate
blind voters, but this is needed only for those blind voters who are
unable to use the headphones.

A ballot reading wand.

The ballot reading wand attaches to the ballot holder and operates as
an input device to the computer system that is part of the ballot holder.
Blind and illiterate voters should be able to use this to read items on
the ballot. The wand includes sensors that allow blind voters and others
who are curious to inspect their ballots to determine what votes the
mark-sense ballot tabulator will count. The wand can be augmented to
provide tactile feedback, a feature that may be useful to blind
voters who have difficulty with the headphones -- the same voters who
will likely benefit from a braille overlay.

Headphones.

The primary source of feedback from the ballot reader to a blind
or illiterate voter should be provided by headphones.
These should be hearing-aid compatible, and may include integral volume
control if this is not part of the ballot holder electronics.

A privacy folder (not shown in Figure 1).

Just as privacy folders are provided to users of conventional
paper ballots and optical mark-sense paper ballots, we should provide
such a folder for users of this handicapped accessible voting system.
This folder could be integrated with the ballot holder, or it could be
a conventional paper or cardstock folder large enough to enclose the ballot
holder.

A chair (not shown in Figure 1).

While many voters will be comfortable standing while they vote, a chair
should be provided for those who wish to sit. The chair should be easily
movable and when it is set aside, the booth should be wheelchair accessible.

It should be noted that it may not be a good idea to designate a single
handicapped accessible voting booth and equip it with all of these tools
while equipping none of the others. Voters who need wheelchair accessibility
or who need to sit while voting may not need the magnifying glass and ruler.
Voters who are blind may be perfectly comfortable voting while standing up.
Therefore, it may be appropriate to keep most of these tools at the
registration table, dispensing them on demand to voters who request them;
if this is not done, it may be reasonable to equip more than one booth
in each polling place with some or all of these tools. The ballot holder,
wand and headphones, in particular, must be kept at the registration table
when not in use.

The ballot holder

The proposed ballot holder is a complex piece of equipment that serves
several purposes. At a gross level, the ballot holder consists of two
transparent plastic sheets that sandwich the ballot, joined by an
electronics assembly along one edge. Each voting target
on each side of the ballot sits at the bottom of a conical hole in the
ballot holder; the term voting target refers to the area of
a ballot where the voter is expected to make a mark when voting for
a particular candidate.
The top edge of the ballot sticks out of the top of the holder, and
a binder clip or some other kind of clamp should be used to prevent the
ballot from sliding around in the holder during voting.
In addition, the entire holder may be
enclosed in a privacy folder to hide the votes that have been cast, or
optionally, integral privacy covers may be attached to the holder with hinges.
Figure 2 shows a ballot inserted in the ballot holder.

Figure 2: The ballot holder.

The proposed ballot holder is designed to meet the needs of two different
classes of handicapped voters:

Voters with moderate to severe motor impairments.

The ballot holder protects the face of the ballot from stray marks,
preventing marking anywhere but the voting targets. The shallow conical well
over each voting target helps guide the pencil point to the target and
constrains marks to that target. The use of similar masks over typewriter
and computer keyboards has been established for many years as an effective
way to allow those with severe motor disorders to use such machinery, and
it should be equally effective with mark-sense forms. Note that, so long
as the voter can read the ballot through the holder, we do not rely on the
electronics, and in fact, for such voters, it may be best to leave the
headphones and wand detached to make the holder easier to manipulate.

Blind voters.

For blind voters, the ballot holder allows the voter to feel the
locations of the voting targets. If a braille overlay is provided, voters
literate in braille could vote entirely by feel once a ballot is properly
inserted in the holder, but they would be unable to verify that their pencil
marks were sufficiently dark to be read as votes. Because of this, and because
many blind voters do not know braille, we provide a wand that works,
in conjunction with the electronics in the holder. When the wand is
pointed at a voting target, the electronics plays a recording over the
headphones giving the candidate name and party associated with that target
and a statement of whether that voting target has been marked. Optionally,
the wand can also give tactile feedback when it is pointed at a marked
voting target.

Illiterate voters.

The ballot holder, wand and headphones may also be used by illiterate
voters to read the ballot to them. When no voters are present who need
these tools, and when the polling place is not crowded, it is a good idea
to let fully able voters use this system if they wish so that they may
verify that it is behaving honestly.

Constraints on Ballot Design

Given that the cost of the ballot holder is likely to depend on the
production volume, we are under strong pressure to get the design right
prior to the first mass-production run. Therefore, we should answer
some basic questions up front. How far apart should candidate names be
placed on the ballot? How big should the holes over each voting target be?
Do voting targets belong on the left or
right side of the candidate name? It would be very bad to have made thousands
of these ballot holders using one set of answers to these questions only
to discover that using other answers would significantly reduce the rate
of voter errors!

Figure 3 shows an extremely simple ballot in a ballot holder with
the top half of the holder torn away. This ballot includes write-in
blanks for each race, and two votes have been cast using identical marks
made through the holes in the holder. This ballot and the holder made for
it illustrate several problems we face in developing this system.

Figure 3: A ballot in the holder with write-in blanks.

First, it is unlikely that we will be able to afford to custom build ballot
holders for each distinct ballot layout!
If we use this system to achieve handicapped accessibility, we will have
to build ballot holders with a fixed set of holes, and then design each
of our ballots to fit those holders.
This is a familiar problem to designers of punched-card ballots,
so we know it can be done, but the current design trend in optical mark-sense
voting systems has moved toward a far greater degree of flexibility,
flexibility that will be negated by the use of the proposed ballot holder!

If we pack 4 candidate names per inch in each column (one every
6.5 millimeters; this is a very
common packing density on today's ballots), then we can easily put 40
voting positions in each column of a standard sheet of typewriter paper
(11 inches or 28 centimeters high). If we put 3 columns
on the page, this allows one-sided ballots with 120 voting positions and
two-sided ballots with 240 voting positions. If we use legal size paper
(14 inches or 35 centimeters high), the same constraints give us 312 voting
positions. This compares favorably with punched-card ballots, where the
common ballot layouts have 228, 235 and 312 punch positions.

If we design a ballot holder with 240 pre-drilled holes, most elections
will only use a fraction of these. Putting the wand tip into an unused
hole should make it say something like "unused ballot position."
Playing this message back hundreds of times while searching for valid
voting positions would be annoying, so we should plug unused holes in the
ballot holder so that blind voters can easily find the valid voting positions
by feel.

The optimal hole-size is partially a human factors problem, but it also
depends on the unfortunate fact that paper changes size with changes in
humidity. Printers frequently use the rule of thumb that a 10% increase in
relative humidity causes paper to expand by about by one part in 1000;
as a result, the size of a piece of bone-dry paper could expand by as much
as 1% as it picks up moisture in an extremely humid environment. This
comes to 1/10 inch in 10 inches, while many mark-sense voting targets are
about 1/8 inch in their short dimension!

Write-in votes pose additional problems! The ballot holder shown in
Figure 3 has rectangular windows in it over each write-in position.
How important is the right to cast a write-in vote?
Can a sufficient fraction of the blind population write a candidate name
legibly in such a window? How many positions on the ballot should
be reserved for write-in votes, and where on the ballot should they go?

Depending on how we answer these questions about write-in votes, we face
several options:

Ban write-in voting

Most election officials hate dealing with write-in votes, and in races
where the major parties have nominated candidates, most write-in votes have
no effect on the outcome. Therefore, in most races, those who cast
write-in votes could just as well have abstained. Unfortunately, there
is one important exception to this. The major parties sometimes fail to
nominate candidates for what might be considered minor local offices. When
this occurs, the right to cast a write-in vote can be important!

Some of today's direct recording electronic voting systems come uncomfortably
close to banning write-in votes by using nonstandard keyboard layouts on a
touchscreen for write-in votes. Entering in a single write-in vote on these
machines sometimes takes longer than it takes to vote the entire
remainder of the ballot, even for fully able voters. The provisions these
systems provide for blind voters wishing to cast write-in votes are frequently
even more cumbersome!

Straight-jacket ballot layout

If we insist on a rectangular cutout over each write-in blank, if we
insist on a write-in blank for each race on the ballot, and
if we allow for 9 nominated candidates per partisan race, we might
put a cut-out write-in window in the ballot holder
every 10 voting positions down most columns of the ballot (the final
column might have no write-in cutouts, being reserved for yes-no issues.
All ballots designed for use in this holder would have their races laid
out in terms of these write-in windows.

This constrains the ballot layout in much the way that old-fashioned
lever voting
machines constrain ballot layout. On such machines, one column on the
face of the machine was reserved for each race, with the write-in window
at the top of each column. Short voters had difficulty reaching
the write-in windows on these machines, and once they wrote a name in,
short voters could not easily read what they had written.

Limit the number of write-in votes allowed per ballot

If we allow only one write-in vote per ballot, or alternately one
per side of the ballot or one per column, a single write-in window
somewhere on the ballot, somewhere on each side, or at the bottom of
each column will suffice. In this case, we may need two
windows per write-in blank, one for the office title and one for the
candidate name, or alternatively, a number of voting targets by each
write-in blank, one per office to which the write-in blank may be applied.

This constraint on write-in voting is similar to the constraints on
write-in votes on Votomatic-style punched-card ballots, where each ballot
is printed with a single write-in blank on the ballot stub.

The most common style of voting target is an oval or ellipse; A round hole
in the ballot holder that substantially covers such an oval or ellipse
should pose no problem, as Figure 3 illustrated. The other common style of
voting target is a broken arrow; these are used on the Optech line of
precinct-count ballot tabulators. The same ballot holder used for elliptical
voting targets should also work for the broken arrow style, as is shown
in Figure 4.

Figure 4: A broken-arrow ballot in the holder;
alternate styles of write-in blanks are shown.

Most tabulators designed to count broken-arrow ballots will easily detect and
count the scribble marks shown in Figure 4. In fact, most optical mark-sense
ballot tabulators are not sensitive to the distinction between a
broken-arrow voting target and an elliptical voting target. In some states,
however, the legal definition of a valid mark on the ballot is quite strict,
requiring that the mark made by the voter actually connect the two halves of
the arrow. Despite the fact that most ballot tabulating machines are unable
to enforce such a law, we should not use this approach to handicapped access
in such states because a blind voter cannot determine whether a mark meets
this legal requirement using the mechanism proposed here.

Figure 4 also illustrates two alternative styles of write-in cutout for
the ballot holder. While it is certain that some blind voters will be
able to write legible (if crudely block-printed) candidate names in a
simple rectangular write-in cutout, it is not obvious that enough will
be able to do so for this idea to be acceptable.

The ability of blind voters to use such a cut-out to guide a write-in
vote may be markedly better for one cutout size than for another, so
we must determine the best size for such a cutout before we commit
to manufacturing. Furthermore, modified cutouts may allow an even
larger number of blind voters to cast legible write-in votes. For
example, we might do better with a cutout that consists of an array of
rectangular holes, one for each letter of the write-in name, or we might
do better if the cutout has index points along the edges to suggest an
appropriate letter spacing without imposing it the way cutouts for each
letter do. Both of these alternatives may limit the number of characters
in the name, forcing the voter to use abbreviations and possibly limiting
the use of this system in states where abbreviated candidate names are
not allowed in write-in blanks.

The answer to the questions about the ability of blind voters to cast
write-in votes may change if the voter is encouraged to practice with a
sighted tutor prior to voting, either at the polling place or prior to
arriving. It is also possible that we will conclude that the rights of
blind voters are sufficiently protected if we rely on human assistance in the
voting booth for write-in votes while relying on mechanical assistance
for most voting.

Some of the above choices rest fundamentally on legal considerations.
Depending on the design of the ballot holder, one or more state laws may
have to be changed in order to use this system. In other cases, the choices
we face may require human-factors experiments. Furthermore, because the
use of manufactured ballot holders will preclude, for the life of the system,
any major changes in ballot design, we should be very careful about
a number of other human factors issues before we commit to manufacturing.

Technology

The electronics of the proposed ballot holder and wand can be broadly divided
into three subsystems. First, the wand contains an optical mark-sensor.
Second, the wand and pad, together, contain a system that allows the
electronics to sense when the tip of the wand is pointed at a voting target,
and third, the system includes the recording and playback mechanism used
to give feedback to the voter.

Inside the Wand

The wand contains an optical mark sensor in its tip, a mechanism to detect
the position of the wand, and optionally, a tactile feedback device, as shown
in Figure 5.

Figure 5: Components of the wand.

The optical mark sensor

There are a number of vendors for infrared proximity sensors, including
Fairchild Semiconductor QRD1113, QRD1114 and QRE1113.GR, and the Panasonic
CNB1001, CNB1002 and CNB1302. Competing products are made by several others.
These sensors consist of an
infrared light-emitting diode (LED) and a matched photodetector packaged
as a single component. Visible light mark-sensing, as opposed to infrared
mark-sensing, will require the use of a visible-light LED, preferably green
or yellow, plus an appropriate photodetector.

Whatever the details of the mark sensor, power for the LED is provided
by the electronics on the ballot holder, and the output from the photodetector
is an input to the electronics. Typically, the electronics will modulate
the light output from the LED and sense the amplitude of the modulated signal
sensed by the photodetector in order to judge the presence or absence of a
mark. The use of modulated light makes the system less sensitive to
ambient lighting conditions.

The position sensing system

The electronics in the ballot holder needs some way to sense the position
of the tip of the wand relative to the ballot holder. Many alternative
ways for doing this have been explored since the 1960's by those interested
in building graphics tablets -- pen-based graphical input devices for
computers.

Almost any graphics tablet technology can be used here, but the illustration
shows a mechanism that uses antenna wires in the ballot holder and a
coil in the tip of the wand. The electronics in the ballot holder measure
the inductive coupling between the antennas and the coil in order to determine
the location of the wand tip. As shown, the antennas divide the ballot into
rows and columns, so the electronics need only find which antenna loops have
the strongest coupling to the wand in order to locate it -- there is no need
for complex triangulation.

The optional tactile feedback mechanism

Tactile feedback is a common feature of cell-phones and pagers; the
wand could contain a similar tactile feedback mechanism, used to confirm
when it is pointed at a marked ballot position. One common tactile feedback
mechanisms that suggests itself for this context is a small electric
motor with an eccentric weight on the shaft. Another is an electromagnet
operating on a spring-mounted weight.

Inside the Ballot Holder

Figure 6 shows an exploded cross-section of the ballot holder, showing all
of the layers of the system except the optional privacy cover and the optional
braille overlay or overlays. The following text discusses the components.

Figure 6: Cross-section view of the ballot holder.

Top and bottom masks

In terms of bulk, these are the largest parts of the system. Made of
transparent plastic, probably machined Plexiglass in prototypes and
injection-molded Lexan in production models, these two sheets have tapered
holes over each potential voting position on the ballot. Their primary
purpose is to support and protect the ballot, but they also serve to support
the guard sheets and antenna grids. It should be possible to separate the
masks for cleaning, but in use, it is likely that they will be rigidly attached
to the electronics along the spine of the ballot holder, with just enough
space between them to allow a ballot to be slid in from the top.

Top and bottom guard sheets

The primary purpose of these sheets is to block the voting positions
that are not enabled for the current election. Therefore, they must be
disposable, and new sheets must be made for each election. It must be
easy to observe the correct alignment of the ballot with the holder, so
these sheets must be transparent. It may be possible to use vinyl overhead
projector transparency film for these sheets, using something like a paper
punch to punch the holes required to enable the voting positions. If the
guard sheets are made of the kind of plastic used in Colorforms, they could
self-adhere to the ballot holder. Alternatively, they could be clipped to
the holder at the spine by the edges of the cover over the electronics, and
clipped at the outer edge by the same binder clip that clamps the ballot
in place. The use of a disposable guard sheet has the secondary benefit of
preventing the surface of the ballot holder from becoming scratched during
years of use.

Horizontal and vertical antenna grids

The antenna grids shown in the cross section are only one possible
way of locating the wand relative to the ballot. In Figure 6, the vertical
antenna grid is shown on the ballot side of the bottom mask, while the
horizontal grid is shown on the ballot side of the top mask. This is only
one possible arrangement, one that is reasonable if the antennas are made
of fine wire glued into channels in the masks, or if the antennas are made
using photoetched copper plating directly on the inside of the masks.
If the masks are injection molded, the antenna grids may be embedded in
the masks instead of applied to them after manufacturing.

Electronics

The electronics assembly could be on a separate circuit board, as shown,
or it could be mounted on a flexible transparent printed circuit that also
includes the antenna grids and is bonded to both top and bottom
masks. The latter eliminates problems with bonding antenna wires to the
electronics assemblies, but it may not be feasible if the physical size of
the electronic components is large, because large components require a rigid
substrate. The primary electronic components of this system are:

Batteries.

This system should use no more power than a portable cassette player
such as a Sony Walkman, so it is reasonable to assume that there will be room
in the electronics assembly for a battery of 2 to 4 AA or AAA cells. Tactile
feedback will likely require the larger number.

The power requirements of this system should be low enough that it is
reasonable to rely on battery power, but optionally, a power adapter could
be included allowing the system to run from external power. In addition,
when connected to external power, the system could be configured to recharge
the batteries.

Power conditioning circuitry.

Battery powered microelectronics typically requires the use of a charge
pump voltage regulator to produce a steady 3 or 5 volts from the variable
voltage put out by the batteries. A second set of charge pumps may be needed
for the audio output drive electronics.

Wand position sensing subsystem.

The antennas on the top and bottom masks may either transmit to a
pickup coil in the wand, or they may receive from a transmit coil in the
wand. Whichever is the transmitter will require drive electronics, and
whichever is the receiver will require sensing electronics. It is likely
that the lowest cost system will rest on a tri-state driver for each
antenna wire, transmitting simple pulses successively on the antenna loops
corresponding to the rows and columns of the ballot. The pickup coil in
the wand would, in this case, be connected to a pulse detector, and all of
these would be interfaced to a small microcontroller that would determine
the timing of the transmitted pulses, search for detected pulses, and
from these, determine the position of the wand.

Radio-frequency emission from the position sensing subsystem poses a serious
problem for this position sensing subsystem, but solutions to this problem
must exist because graphics tablets that use this position sensing method
have been successful.

Mark sensing subsystem.

The mark sensor should only be active when the position sensing
subsystem detects that the wand is over a voting target on the ballot.
Assuming that the wand contains an infrared proximity photosensor,
the electronics must use this to detect when the
wand senses a mark. We must distinguish between ambient light and light
reflected from the marked or unmarked ballot; to do this, it is reasonable
to rapidly blink the infrared LED and then compare the voltage level reported
by the photosensor when the LED is on with the level reported when the LED
is off. This job can be done by a small microcontroller, or
it may be possible to use the same microcontroller that is used for
wand position sensing.

If the difference between the photosensor voltages for the LED-on and LED-off
conditions is too close to zero, the wand is not sensing reflected light.
When the wand is close to unmarked white paper, this difference will be high,
while if the paper has been marked, this difference will be at an intermediate
level. We even have the option of detecting an reporting marks that might
be close to the ballot tabulator's threshold of detection. When such a mark
is detected, the system could report a message such as "either darken
this mark to make a clear vote or get a replacement ballot if you did not
intend to make a mark here."

The mark sensing thresholds implemented by the wand must be comparable to those
used in the ballot tabulating machine, and they must conform with the legal
standard for what constitutes a vote.

The audio feedback subsystem

The wand position sensing subsystem and the mark sensing subsystem
serve one primary purpose, to elicit audio feedback to the voter indicating
whether a mark has been sensed. The audio feedback system requires an
audio amplifier for the output, a small digital signal processor, and some
kind of compact digital memory for the recording.

The recording for each ballot position should average about 5 seconds
(The message "Abraham Lincoln, Republican, for President" can be said quite
clearly in this time). If we assume a 228 position ballot, the total sound
recording capacity of the system will be 5×228 or 1140 seconds. This
is 19 minutes. Telephone quality audio can be reproduced with 6000 8-bit
samples per second, so if our system can store 6000×1140 or
6,840,000 8-bit samples, it will be able to reproduce the necessary amount
of audio information. Data compression can reduce this considerably while
increasing the fidelity of the sound playback! If we do no compression,
we can use a trivial digital signal processor, even a commonplace
microcontroller. The more compression we do, the more complex the software
required on the digital signal processor.

The estimate of 19 minutes of recorded sound can also be used as the basis
for the estimated programming time for this system, per precinct, the
estimated time required for a full pre-election test of the system, and the
time taken by a voter who doggedly plays back the recorded message for each
enabled voting target. To record or verify 19 minutes of sound will
probably take 30 minutes, allowing for the time it takes to select the
voting targets for which recordings are being made. Fortunately, extremely
few elections will ever use every voting target on a 228 position ballot.
A general election involving 10 partisan races and 10 parties, however,
could easily use half of the positions on the ballot, so for such an
election, recording the ballot for one polling place will frequently
take 15 minutes, as will pre-election testing and the slowest voters.
(These time estimates apply equally well to almost any handicapped accessible
audio voting system!)

The above accounting ignores the recording requirements for
the standard messages "you have voted for," "mark here to vote for," and
"disabled ballot position." These do not add greatly to the above
totals, even if they are recorded in several languages. (Note that there
should be no need to record candidate or party names in multiple languages.)
Thus, it is fair to conclude that an 8 megabyte memory will suffice;
Flash EEPROM memory with this capacity is available and suitable for
this function.

Controls and indicators.

In voting mode, this system should have no user accessible controls
except the on-off switch and the volume control for the headphones.
Depending on how the system is programmed, there may be no other operating
mode! For example, if the flash EEPROM used for the sound recording is
removable, programming may be done externally.

A fully self-contained system, on the other hand, would require a microphone
for sound input. In this case, there could be an external switch to put
the system into programming mode, or if an external microphone is used, the
system could sense the presence of the microphone and enter programming
mode whenever the microphone is plugged in.

The system should have a status indicator, perhaps
an LED, to warn that the system is in programming mode, and it should
have a second indicator that comes on when the machine is actually recording.
When in programming mode, the wand can be used as a control input to select
the voting target for which a recording is being made or to select the special
message that is being recorded. Additional antenna loops may need to be
included in the holder for the latter; these loops should only be active
in recording mode.

Cover over electronics

The cover could serve to secure the electronics assembly and
top and bottom masks, or it could be clipped on over them, relying on
some other mechanism to secure these parts. The edges of the cover
can be made to serve as clamps for the top and bottom guard sheets or
for braille overlays, but if the guard sheets adhere to the top and
bottom masks, this may not be needed. An integral privacy folder
could also be hinged to the cover.

Security and Audit Requirements

For any voting system, we must have an assurance that the system behaves
as intended when used by voters in the privacy of the voting booth
We typically assure this through a combination of the following means:

Design audit

The design of the system, both hardware and software, should be
inspected to determine if there are any features that could misbehave.

Manufacturing and delivery audit

The construction of the system should be monitored to assure that
the systems, as built and delivered, conform to the design that was
approved.

Pre-election programming

The mechanism for routine loading of information specific to a
particular election should not be able to change the approved design
or general function of the system.

Pre-election test

Prior to an election, the system should be tested to verify that it
behaves as required.

Post-election test

After an election, particularly in the event that there are charges of
irregularity, it should be possible to test the system to verify its
function, and if there is any possibility of hidden functionality that
cannot be disclosed by testing, it should be possible to verify that
the system, as used during the election, conformed to the design
that was approved.

Figure 7 shows the internal structure of the electronics that will be
assumed for the purpose of the following discussion of the application of
these requirements to this system. The system pictured in the figure is
self-contained, with no external components other than the wand, microphone
(if not built-in) and headphones, and no external connections allowing
modification to the firmware or to the contents of the flash EEPROM used
for audio recording.

Figure 7: An auditor's view of system structure (simplified).

If the system is implemented using three separate microcontrollers,
one for each subsystem, and communicating over unidirectional data paths
following the outline in Figure 7, the design auditor's job will be
significantly simplified.

There is no persistant real-time clock anywhere in the system. Therefore,
the system cannot be programmed to behave one way during testing and another
way on election day, using the date and time to trigger its improper behavior.
Therefore, an attempt to program this mechanism to behave improperly when
the polls are open but not at other times would require some kind of user
input after the machine is turned on.

The data path design given in Figure 7 prevents the wand position subsystem
from being aware of the markings found on the ballot and it prevents the
mark-sense subsystem from being aware of the position of the wand or the
operating mode. Therefore, any special control input to place the machine
in an improper operating mode cannot involve interaction of these two
subsystems.

If the mark-sense subsystem and speech subsystem are powered down or reset
when they are not enabled, and if these subsystems have no persistent memory
other than the actual spoken messages stored in the flash EEPROM, then these
systems begin operating with a clean slate each time the wand is moved to
a new voting position on the ballot. As a result, neither the mark-sense
subsystem nor the speech subsystem can contain hidden functions that are
evoked by, for example, some obscure sequence of inputs from the wand or
mark-sense systems.

The wand position subsystem can potentially be programmed to remember the
sequence and timing of inputs and behave in an improper way if voting
targets are accessed in an odd order. For example, a programmer might arrange
things so that turning the system on while pointing the wand at voting target
47 would make it behave in an improper way. Therefore, the design and source
code audit should verify that the wand position subsystem retains no state
information from one search for the wand position to the next.

The speech subsystem has access to the flash EEPROM, and it could potentially
store historical information there, using this to trigger inappropriate
behavior or to illegally store a record of the votes cast by the voter.
To prevent this, the design audit should verify that the system cannot
store data in the flash EEPROM except when it is in recording mode, and that
it does not store anything there but audio recordings and their connections
to ballot locations.

The status indicators allow major aspects of the wand position subsystem and
the mark-sense subsystem to be completely and easily tested without regard
to the information stored by the speech subsystem.

The pre-election test, therefore, should include an observation of these
indicators as the wand is pointed at each enabled voting position on the
ballot, as well as listening to the recording for each position to verify
that it matches what is printed on a test ballot, and then marking some
voting positions on the test ballot to verify that the report of the marking
is correct.

Once the system has been verified to be correctly programmed for a particular
election, a physical seal should be put over the microphone input and over
the record/voting mode switch (if this is not integral to the microphone
jack). This seal should also prevent the cover over the electronics
from being opened or removed. So long as this seal is unbroken, election
day testing and post-election testing of the system should show that it
matches the ballot for which it was prepared.

Each time a voter requires the use of the ballot holder, polling place
officials should verify, that the voting targets align correctly with the
holes in the guard sheets and mask after they have clamped the ballot in
place so that it will not slip. They should also randomly sample some of
the voting positions with the wand and verify that the recordings for
those positions are correct before they put the holder in a privacy folder
and give it to the voter.

Some commentators have suggested that each voter should demonstrate their
understanding of the ballot marking instructions prior to entering the
voting booth, for example, by having a voting target on the affidavit
of elegibility that the voter signs to request a ballot. If we move this
test voting target to the ballot itself, we can use it to allow the voter
to complete the pre-voting test by marking the test target and then checking
that the wand can read the voter's own mark on the real ballot.

Cost Projection

A preliminary cost estimate for the proposed system requires greater design
detail than was given previously; nonetheless, the estimate that follows
should be taken in very rough terms. This estimate is not based on a full
design, but rather on guesses about the types of components that will
suffice. While many of the costs are almost certainly overestimated, many
minor components have almost certainly been overlooked, and some major
costs may have been seriously underestimated or omitted; as a result, it
is reasonable to guess that the total cost for components of the system
will be somewhere near the estimate given and probably not twice this sum.

Auxiliary Items

Ruler

$1

Magnifier

$10

Headphones

$15

-total-

$26

Ballot Holder

Lexan top and bottom masks

$20

Aluminum electronics cover

$1

Circuit board @ $1.00/sq-in

$14

Position sense micro...

$5

Mark-sensor microcontroller

$5

Speech microcontroller

$5

8x8meg flash EEPROM

$40

Oscillator

$3

Antenna interfaces

$18

Connector for wand

$1

Connector for AC adapter

$1

Connector for headphones

$1

Microphone

$1

Audio amplifier

$1

Volume control

$2

Programming mode switch

$1

LED indicators

$3

Battery holder

$1

Power conditioning circuitry

$10

-total-

$133

Wand

Housing

$5

Circuit board @ $1.00/sq-in

$2

Proximity photosensor

$1

Pickup coil

$1

Cord and connector

$3

-total-

$12

Grand Totals

Auxiliary items

$26

Ballot holder

$133

Wand

$12

--total--

$171

To this, we must add the cost of manufacturing, but this is unlikely to
double the figure. From this, it is fair to guess that the total cost
of equipping a mark-sense polling place for handicapped accessible
voting is likely to be around $250, and even if warehousing and distribution
costs plus a fair profit margin double the cost, we can still expect the
total to be under $500.

Patents

US Patent 5,585,612, granted December 17, 1996, includes broad coverage
of audio feedback for handicapped voters, but focuses on the use of a
tactile map, with spoken direcitons for navigating the map to a particular
voting target. It also includes the idea of a guide to allow a marker to
be used to mark the target through a hole in a mask, and it includes audio
feedback about how a vote was cast. Unlike the ideas presented here, the
map is followed by the voter under instruction from the audio mechanism,
instead of having the audio mechanism respond to the voter's position on
the ballot.

In July 2003, I learned that the proposal here has competition,
a device called the AutoMark voting system from
Vogue Election Systems, advertised to be available starting
in the fall of 2003. That system looks viable, but at
a price that I'd guess would be from $2000 to $5000 per polling
place, 10 times my estimate for the device described here.

The first public disclosure of the ideas presented here were
was in the section on Handicapped Access in
"Voting System Standards, Work that Remains to be Done,"
by Douglas W. Jones, testimony presented on April 17, 2002, at a
public hearing of the Federal Election Commission in Washington DC.
Indexed on the web at:
http://www.cs.uiowa.edu/~jones/voting/fec3.html#access

The germ from which these ideas came was planted
by Jim Dickson of the American Association of People with Disabilities
as we ate dinner together
after the January 11 2001 public hearing before the
United States Civil Rights Commission in Talahassee. Jim Dickson
has examined this material, and he is not convinced that the
invention disclosed here would be a useful improvement; neither he
nor the AAPD endorse this device. Clearly, there is room for
additional work and innovation.

The final paragraph of the followup I submitted to the Civil Rights
Commission on February 15 2001 presents my first proposal for
the device that evolved into the ballot holder described here.
This is indexed on the web at:
http://www.cs.uiowa.edu/~jones/voting/uscrc1.html